CWE-73: External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- datarecce recceRecce server has unauthenticated SQL execution that allows local file read/write through DuckDB7.8 High
- elemntor image optimizer – compress images and convert to webp or avifImage Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection8.1 High
- oras-project oras-gooras-go: file store write outside workingDir via symlink traversal6.9 Medium
easycorp/easyadmin-bundlePackagistEasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components5.3 Medium- imagemagickImageMagick: Policy Bypass in concatenate operation due to missing checks5.5 Medium
- keras-team keras-team/kerasArbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras5.5 Medium
- cmsjunkie wp-businessdirectory – business directory plugin for wordpressWP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter9.1 Critical
- ibm app connect enterprise, integration bus for z/os, integration bus +2 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection4.7 Medium
- citrix netscaler gateway, netscaler adc, gateway +1 more +3 moreArbitrary File Read (Unauthenticated)7.1 High
- snowflake cliSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction6.3 Medium
- nmedia frontend file manager pluginFrontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- pnpmpnpm: patch-remove could delete project-selected files outside the patches directory7.1 High
- pnpmpnpm: hoisted install imports lockfile alias outside node_modules7.1 High
- lxc incusIncus has an arbitrary file write via path traversal in S3 multipart upload9.9 Critical
- lxc incus, canonical lxd +1 moreIncus has arbitrary file read+write on host via templates/ symlink in malicious image9.9 Critical
- lxc incusIncus has an arbitrary file write on host via `exec-output` symlink in crafted image9.9 Critical
- lxc incus, canonical lxd +1 moreIncus has an arbitrary file read+write on host via rootfs/ symlink in malicious image9.9 Critical
- pnpmpnpm: stage download writes outside destination via manifest version traversal7.1 High
- pnpmpnpm: reserved bin name deletes PNPM_HOME during global remove6.5 Medium
- mhsanaei 3x-uiAuthenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation7.2 High
- fatpipe warpWarp: SSH remote output can lead to local file overwrite and persistence8.8 High
- octoprintOctoPrint: File exfiltration possible via query parameters on upload endpoints7.0 High
- jovancoding network-aiNetwork-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning7.1 High
- cliEntire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind6.2 Medium
- pontedilana php-weasyprintPhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles3.0 Low
- jetbrains golandIn JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project...7.1 High
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source6.5 Medium
- line corporation armeriaArmeria: External Control of File Name or Path in xDS SDS DataSource5.9 Medium
- nodemailernodemailer before 9.0.1 File Read and SSRF via raw option7.1 High
- mervinpraison praisonaiPraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion8.1 High
- black lantern security bbotArbitrary File Write in postman_download module6.5 Medium
- serverco getsslServerCo getssl ACME shell script path injection7.4 High
- langflowLangflow: Unauthenticated Shareable Playground arbitrary local or S3 file read6.1 Medium
- vitejs launch-editor, vite, vite-plus +2 moreNTLMv2 hash disclosure via UNC path handling on Windows5.5 Medium
- wertheim gmbh safecontroller software for vault rooms (safe deposit locker system)Improper branch-code validation in Wertheim SafeController Software allows file path manipulation6.9 Medium
org.snmp4j:snmp4j-agentMavenSNMP4J-Agent allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component9.8 Critical- shlomif config::inifilesConfig::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle8.6 High
- osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core +2 moreGeoServer has an arbitrary file write vulnerability in its Master Password Dump Page7.2 High
- microsoft gdGD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle9.8 Critical
- roxy-wiRoxy-WI: Authenticated arbitrary file write on every managed load balancer (and downstream RCE) via WAF rule save `config_file_name`9.9 Critical
- microsoft azure stack edgeAzure Stack Edge Remote Code Execution Vulnerability9.8 Critical
- petdance app::ackApp::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc7.5 High
- wpvividplugins wpvivid — backup, migration & stagingMigration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion3.8 Low
- haxtheweb haxcms-php, haxcms-nodejs +1 morehaxcms-php Local File Inclusion via saveOutline API Location Parameter v2.06.5 Medium
- haxtheweb haxcms-nodejs, haxcms-php +1 moreAuthenticated Remote Code Execution via File Overwrite9.4 Critical
- tautulliTautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API5.7 Medium
- docling-project docling-coreDocling Core has insufficient validation of image reference URIs8.1 High
- doclingDocling: Unsafe URI and Path Handling in HTML Backend7.1 High
- cisco finesseCisco Finesse File Inclusion Vulnerability6.1 Medium
- mbs double-a profibus, double-a x-link, double-x can +16 more +18 moreArbitrary file delete vulnerability in method ugw-restoreinfo7.2 High
- Show moreLoading…